Microsoft Entra ID must use Privileged Identity Management (PIM)

Contributed by Merill FernandoAll contributors →

Part of DISA · Entra ID · Privileged Identity Management · All checks

Run this check

Invoke-Maester -TestId DISA.V-270335

Overview

No privileged Microsoft Entra role has an active assignment that never ends. (DISA Microsoft Entra ID STIG, V-270335, CAT II).

A permanent active assignment keeps admin rights on an account around the clock, so a stolen session or password gives them straight away. With Privileged Identity Management, users hold the role only when they activate it, for a limited time.

DISA’s check looks at the active assignments of each privileged role and is a finding when one ends Permanent. This test runs CISA.MS.AAD.7.4, which checks the roles that CISA counts as highly privileged. Review the other privileged roles in your tenant by hand.

Remediation action

1. In the Microsoft Entra admin center, go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Assignments.
2. On the Active assignments tab, find the assignments whose end time is Permanent.
3. Change each one to an eligible assignment, leaving permanent active assignments only on your emergency access accounts.

Related links

• DISA Microsoft Entra ID STIG: V-270335
• Start using Privileged Identity Management

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-270335
Severity	High
Suite	DISA
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
Resource type	DirectoryRole
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1098.003 Additional Cloud Roles
Supports benchmark	DISA Microsoft Entra ID STIG (version V1R2), requirement V-270335
Supports controls	disa-stig-entra-id:V-270335, nist-800-53-r5:AC-2(2)
PowerShell test	Test-MtDisaEntraNoPermanentPrivilegedAssignment
Services	Graph
Compatible licenses	AAD_PREMIUM_P2, Entra_Identity_Governance

Source

• Test: tests/disa/Test.DISA.V-270335.ps1
• Documentation: tests/disa/Test.DISA.V-270335.md